| Debugging Tools for Windows |
The WDF_VIOLATION bug check has a value of 0x0000010D. This indicates that Kernel-Mode Driver Framework (KMDF) detected that Windows found an error in a framework-based driver.
The following parameters are displayed on the blue screen. Parameter 1 indicates the specific error code of the bug check. Parameter 4 is reserved.
| Parameter 1 | Parameter 2 | Parameter 3 | Cause of Error |
|---|---|---|---|
| 0x1 | Pointer to a WDF_POINTER_ROUTINE_TIMED_OUT_DATA structure | Reserved | A framework-based driver has timed out during a power operation. This typically means that the device stack did not set the DO_POWER_PAGABLE bit and a driver attempted a pageable operation after the paging device stack was powered down. |
| 0x2 | Reserved | Reserved | An attempt is being made to acquire a lock that is currently being held. |
| 0x3 | WDFREQUEST handle | The number of outstanding references that remain on both buffers | Windows Driver Framework Verifier has encountered a fatal error. In particular, an I/O request was completed, but a framework request object cannot be deleted because there are outstanding references to the input buffer, the output buffer, or both. |
| 0x4 | Reserved | The caller's address | A NULL parameter was passed to a function that required a non-NULL value. |
| 0x5 | The handle value passed in | Reserved | A framework object handle of the incorrect type was passed to a framework object method. |
| 0x6 | See table below. | ||
| 0x7 | The handle of the framework object | Reserved | A driver attempted to delete a framework object incorrectly by calling WdfObjectDereference to delete a handle instead of calling WdfObjectDelete. |
| 0x8 | The handle of the DMA transaction object | Reserved | An operation occurred on a DMA transaction object while it was not in the correct state. |
| 0x9 | Currently unused. | ||
| 0xA | A pointer to a WDF_QUEUE_FATAL_ERROR_DATA structure | Reserved | A fatal error has occurred while processing a request that is currently in the queue. |
| 0xB | See table below. |
If Parameter 1 is equal to 0x6, then a fatal error was made in handling a WDF request. In this case, Parameter 2 further specifies the type of fatal error that has been made, as defined by the enumeration WDF_REQUEST_FATAL_ERROR.
| Parameter 2 | Parameter 3 | Cause of Error |
|---|---|---|
| 0x1 | The address of the IRP | No more I/O stack locations are available to format the underlying IRP. |
| 0x2 | The WDF request handle value | An attempt was made to format a framework request object that did not contain an IRP. |
| 0x3 | The WDF request handle value | The driver attempted to send a framework request that has already been sent to an I/O target. |
| 0x4 | A pointer to a WDR_REQUEST_FATAL_ERROR_INFORMATION_LENGTH_MISMATCH_DATA structure that contains a pointer to the IRP, a WDF request handle value, an IRP major function, and the number of bytes attempted to be written | The driver has completed a framework request, but has written more bytes to the output buffer than are specified in the IRP. |
If Parameter 1 is equal to 0xB, then an attempt to acquire or release a lock was invalid. In this case, Parameter 3 further specifies the error that has been made.
| Parameter 2 | Parameter 3 | Cause of Error |
|---|---|---|
| The handle value | 0x0 | A handle passed to WdfObjectAcquireLock or WdfObjectReleaseLock represents an object that does not support synchronization locks. |
| A WDF spin lock handle | 0x1 | The spin lock is being released by a thread that did not acquire it. |
See the description of each code in the Parameters section for an explanation of the cause.
Typically, the dump file will yield further information on the driver that caused this bug check.
If Parameter 1 is equal to 0x2, examine the caller’s stack to determine the lock in question.
If Parameter 1 is equal to 0x3, the driver's Kernel-Mode Driver Framework error log will include details about the outstanding references.
If Parameter 1 is equal to 0x4, use the ln debugger command with the value of Parameter 3 as its argument to determine which function requires a non-NULL parameter.
If Parameter 1 is equal to 0x7, use the !wdfkd.wdfhandle Parameter 2 extension command to determine the handle type.
If Parameter 1 is equal to 0xA, then the WDF_QUEUE_FATAL_ERROR_DATA structure will indicate either the problematic request or the queue handle. It will also indicate the NTSTATUS, if not STATUS_SUCCESS, when available.